Regulated entities that cannot demonstrate cybersecurity risks management will find insurance harder to justify or claim.